Islom karimov nomidagi

Safety Recommendations

As appropriate, briefly state any recommendations made for the purpose of accident prevention and any resultant corrective action.

49. Appendices

Include, as appropriate, any other pertinent information considered necessary for the understanding of the report.
Self-Test Questions

1. Investigation - Final Report.

2. Organisational and management information.

3. Useful or effective investigation techniques.

4. Safety Recommendations.


Module 4. Safety hazards and safety risks
Lecture 7. Four fundamental principles of hazards.
OBJECTIVE AND CONTENTS

This chapter presents the fundamentals of hazard identification and analysis and includes the following topics:

Hazards and consequences;

First fundamental — Understanding hazards;

Second fundamental — Hazard identification;

Third fundamental — Hazard analysis; and

Fourth fundamental — Documentation of hazards.

HAZARDS AND CONSEQUENCES

Hazard identification and safety risk management are the core processes involved in the management of safety. They are neither new, nor have they been developed as a consequence of recent interest in safety management and, in particular, safety management systems (SMS). Hazard identification and safety risk management are dogmatic components that underlie the overarching concept of system safety. This is an all-encompassing, engineering-based approach that contributes to system design and which was developed more that forty years ago. The difference between traditional system safety and present-day safety management is that, because of its engineering roots, system safety focused mostly on the safety implications of technical aspects and components of the system under consideration, somewhat at the expense of the human component. Safety management, on the other hand, builds upon the dogma of system safety (hazard identification and safety risk management), and expands the field of perspective to include Human Factors and human performance as key safety considerations during system design and operation.
The differentiation between hazards and safety risks is oftentimes a source of difficulty and confusion. In order to develop safety management practices that are relevant and effective, a clear understanding of what is a hazard and what is a safety risk is essential. This chapter discusses hazards exclusively, while Chapter 5 discusses safety risks. In discussing hazards, and to assist in the understanding of the difference between hazards and safety risks, the discussion splits the overall concept of hazards into two components: the hazard itself, and its consequences. A clear understanding of the difference between these two components is also paramount for the practice of safety management.
A hazard is defined as a condition or an object with the potential to cause injuries to personnel, damage to equipment or structures, loss of material, or reduction of ability to perform a prescribed function. Systems in which people must actively and closely interact with technology to achieve production goals through delivery of services are known as socio-technical systems. All aviation organizations are thus socio-technical systems. Hazards are normal components or elements of socio-technical systems. They are integral to the contexts where delivery of services by socio-technical production systems takes place. In and by themselves, hazards are not “bad things”. Hazards are not necessarily damaging or negative components of a system. It is only when hazards interface with the operations of the system aimed at service delivery that their damaging potential may become a safety concern.
4-1
Consider, for example, wind, a normal component of the natural environment. Wind is a hazard: it is a condition with the potential to cause injuries to personnel, damage to equipment or structures, loss of material, or reduction of ability to perform a prescribed function. A fifteen-knot wind, by itself, does not necessarily hold potential for damage during aviation operations. In fact, a fifteen-knot wind blowing directly down the runway will contribute to improving aircraft performance during departure. However, when a fifteen-knot wind blows in a direction ninety degrees across a runway of intended take-off or landing, it becomes a crosswind. It is only then, when the hazard interfaces with the operations of the system (take-off or landing of an aeroplane) aimed at service delivery (the need to transport passengers or cargo to/from the particular aerodrome while meeting a schedule) that its potential for damage becomes a safety concern (a lateral runway excursion because the pilot may not be able to control the aeroplane as a consequence of the crosswind). This example illustrates the discussion in 4.2.3: a hazard should not necessarily be considered as a “bad thing” or something with a negative connotation. Hazards are an integral part of operational contexts, and their consequences can be addressed through various mitigation strategies to contain the hazard’s damaging potential, which will be discussed later in this manual.
A consequence is defined as the potential outcome (or outcomes) of a hazard. The damaging potential of a hazard materializes through one or many consequences. In the example of the crosswind above, one consequence of the hazard “crosswind” could be “loss of lateral control”. A further, more serious consequence could be “runway lateral excursion”. An even more serious consequence could be “damage to landing gear”. It is important, therefore, to describe all likely consequences of a hazard during hazard analysis and not only the most obvious or immediate ones.
The discussion on the consequences of hazards brings two important points to bear in mind. First, hazards belong in the present. They are, in most cases, part of the operational context, and therefore they are present in the workplace before operational personnel “show up to work”. As physical components of the operational context or workplace, most hazards are, and should be, detectable through audits. Consequences, on the other hand, belong in the future. They do not materialize until hazards interact with certain operations of the system aimed at service delivery. It is as a consequence of this interaction that hazards may unleash their damaging potential. This brings about one essential tenet of safety management: mitigation strategies should aim at proactively containing the damaging potential of hazards and not at waiting until the consequences of hazards materialize and then reactively address such consequences.
Second, for the purpose of safety management, the consequences of hazards should be described in operational terms. Many hazards hold the potential for the ultimate and most extreme consequence: loss of human life. Most hazards hold the potential for loss of property, ecological damage and similar high-level consequences. However, describing the consequences of hazards in extreme terms makes it difficult to design mitigation strategies, except cancellation of the operation. In order to design mitigation strategies to address the safety concerns underlying the less- than-extreme, lower-level operational consequences of the hazard (for example, crosswind), such consequences must be described in operational terms (runway lateral excursion), rather than in extreme terms (loss of life).
Chapter 2 discusses safety as a condition of controlled safety risk. The description of the consequences of hazards that may affect a particular operation is part of the assessment of the safety risks of the consequences of hazards (discussed in Chapter 5). The assessment of the safety risks of the consequences of hazards allows an organization to make an informed decision about whether it can achieve the condition of control of the safety risks and thus continue the operation. If the consequences of the hazard (crosswind) are described in extreme terms (loss of life) rather than operational terms (runway lateral excursion), the safety risk assessment is largely voided, since the condition of control of the safety risks will unlikely be achieved, unless formidable expenditure is incurred, and the likely mitigation will be cancellation of the operation.
FIRST FUNDAMENTAL — UNDERSTANDING HAZARDS
As already discussed, there exists a tendency to confuse hazards with their consequences. When this happens, the description of the hazard in operational terms then reflects the consequences rather than the hazard itself. In other words, it is not uncommon to see that hazards are described as their consequence(s).

Stating and naming a hazard as one of its consequences has the potential for not only disguising the true nature and damaging potential of the hazard in question, but it also interferes with the identification of other important consequences of the hazard.

On the other hand, properly stating and naming hazards allows one to identify the nature and damaging potential of the hazard, to correctly infer the sources or mechanisms of the hazard and, most importantly, to evaluate the outcomes (other than extreme outcomes) in terms of the magnitude of the potential loss, which is one of the final objectives of safety risk management as discussed in Chapter 5.

A further example is presented to illustrate the difference between hazards and consequences. An aerodrome operates with its signage in a state of disrepair. This complicates the task of ground navigation by aerodrome users, both aircraft and ground vehicles. In this case, the correct naming of the hazard could be “unclear aerodrome signage” (i.e. a condition with the potential to cause injuries to personnel, damage to equipment or structures, loss of material, or reduction of ability to perform a prescribed function). As a result of this hazard, many possible consequences are possible. One consequence (i.e. one potential outcome) of the hazard “unclear aerodrome signage” may be “runway incursion”. But there may be other consequences: ground vehicles driving into restricted areas, aircraft taxiing into wrong taxiways, collision between aircraft, collision between ground vehicles, collision between aircraft and ground vehicles, and so forth. Thus, naming the hazard as “runway incursion” instead of “unclear aerodrome signage” disguises the nature of the hazard and interferes with the identification of other important consequences. This will likely lead to partial or incomplete mitigation strategies.

Hazards can be grouped into three generic families: natural hazards, technical hazards and economic hazards.